Access control interfaces for enhanced wireless router

ABSTRACT

A wireless router provides access control to information resources stored at the wireless router. The wireless router supports user profiles and/or device profiles that respectively enable user level and/or device level access control. The wireless router may register users via a user registration interface presented by the client device. The wireless router may register client devices using a device identifier. Requests to initiate a communication session may be received by the wireless router from client devices over a wireless local area network. The wireless router may authenticate a client device based on a device identifier and/or authenticate a user based on user credentials obtained via a login interface presented by the client device. The wireless router may control access to information resources stored at the wireless router during the communication session based, at least in part, on access privileges for the authenticated client device and/or authenticated user.

CROSS-REFERENCE TO RELATED APPLICATIONS

The present application claims priority to and is a continuation of U.S.patent application Ser. No. 14/331,600, titled ACCESS CONTROL INTERFACESFOR ENHANCED WIRELESS ROUTER, filed Jul. 15, 2014, to be issued as U.S.Pat. No. 9,277,405, which claims priority to and is a continuation ofU.S. patent application Ser. No. 13/431,095, titled ACCESS CONTROLINTERFACES FOR ENHANCED WIRELESS ROUTER, filed Mar. 27, 2012, issued asU.S. Pat. No. 8,782,741, which claims priority to and is anon-provisional of U.S. Patent Application Ser. No. 61/540,895, titledSMART ROUTER, filed Sep. 29, 2011. The entire contents of each of theseapplications are incorporated herein by reference in their entirety forall purposes.

BACKGROUND

On-premises wireless routers provide wireless local area network (WLAN)access to client devices in both home and business environments.Wireless routers perform a number of different functions, including arouter function, a wireless access point function, and a network switchfunction. Wireless routers are often connected to a wide area network(WAN), such as the Internet, via a high capacity communications link toprovide client devices of the WLAN with high-speed access to networkresources of the WAN. Wireless routers serve as gateways for multipleclient devices to concurrently access wide area networks.

SUMMARY

A wireless router provides access control to information resourcesstored at the wireless router. The wireless router supports userprofiles and/or device profiles that respectively enable user leveland/or device level access control. The wireless router may registerusers by creating a user profile that contains registration informationobtained via a user registration interface presented by the clientdevice. The wireless router may register client devices by creating adevice profile that contains the device identifier of the client device.Requests to initiate a communication session may be received by thewireless router from client devices over a wireless local area network.The wireless router may authenticate a client device based on a deviceidentifier and/or authenticate a user based on user credentials obtainedvia a login interface presented by the client device. The wirelessrouter may establish the requested communication session between thewireless router and the authenticated client device. The wireless routermay control access to information resources stored at the wirelessrouter during the communication session based, at least in part, onaccess privileges for the authenticated client device and/orauthenticated user. Claimed subject matter, however, is not limited bythis summary as other examples may be disclosed by the following writtendescription and associated drawings.

BRIEF DESCRIPTION OF DRAWINGS

FIG. 1 is a schematic diagram depicting an example computing systemaccording to a disclosed embodiment.

FIG. 2 is a flow diagram depicting an example networking methodaccording to a disclosed embodiment.

FIG. 3 is a schematic diagram depicting an example account identityaccording to a disclosed embodiment.

FIG. 4 is a schematic diagram depicting an example sequence of graphicaluser interfaces forming a profile interface according to one disclosedembodiment.

DETAILED DESCRIPTION

FIG. 1 is a schematic diagram depicting an example computing system 100according to one disclosed embodiment. Computing system 100 includes anumber of computing devices, such as a wireless router 110, one or moreclient devices (e.g., client devices 140, 150), and one or more networkserver devices (e.g., server device 160). Wireless router 110 may bepositioned along a communications path between a wide area network (WAN)180 and a local area network (LAN) 190. Wireless router 110 is depictedproviding LAN 190 access for client devices 140 and 150, and ispositioned at a boundary between LAN 190 and network server devices ofWAN 180. Wireless router 110 may be implemented as on-premises equipmentto provide LAN access to homes, residences, businesses, or othersuitable LAN use environments. In at least some implementations,wireless router 110 may take the form of a private gateway or accesspoint that is owned and/or operated by an owner or operator of the home,residence, business, or use environment in which the wireless router isdeployed, in contrast to some public cellular network base stations.

Wireless router 110 includes communications interface 130 to supportwired and/or wireless communications between client devices of LAN 190and network server devices of WAN 180. Communications interface 130 mayinclude one or more wired and/or wireless transceivers, modems, or othersuitable electronic devices to facilitate communications with othercomputing devices. Communications interface 130 may provide or support arouter function, a wireless access point function, and a network switchfunction. Wireless router 110 may establish communications sessions withclient devices of LAN 190, and may route communications among theseclient devices and/or between these client devices and network serverdevices of WAN 180. As one example, client devices 140 and 150 may shareinformation resources with each other via wireless router 110 and/or mayrequest and receive information resources (e.g., information resource162) from network server devices of the WAN (e.g., server device 160)via wireless router 110.

WAN 180 may take the form of the Internet or a portion thereof. LAN 190may support wired and/or wireless communications between wireless router110 and client devices 140 and 150. If supported, wired communicationswithin LAN 190 may include Ethernet, powerline Ethernet, or othersuitable form of wired communications. LAN 190 may supportcommunications through any suitable type and/or number of wirelessprotocol standards. For example, LAN 190 may support one or more of thefollowing standards: Wi-Fi (e.g., 802.11), Wi-MAX (e.g., 802.16), LTE(e.g., 3GPP TS 36), UMTS (e.g., 3GPP TS 25), CDMA, Bluetooth, or othersuitable wireless protocol.

Wireless router 110 may include a processor system 112 to executeinstructions 116. Processor system 112 may include one or moreprocessors. Instructions 116 may be held in a storage system 114.Storage system 114 may include one or more storage devices. As oneexample, storage system 114 may take the form of non-volatile memory.For example, storage system 114 may include a hard drive, flash memorydevice, or other suitable non-volatile storage device. Wireless router110 may further include volatile memory, which may be used incombination with non-volatile memory of storage system 114 by processorsystem 112 to execute instructions 116. Instructions 116 may include ortake the form of software and/or firmware. For example, instructions 116may include or form part of an operating system 117 of wireless router110, an application program 119, a software component such as a plug-in,or other suitable instruction set, or combination thereof.

Wireless router 110 may perform a number of different functions,including a router function, a wireless access point function, a networkswitch function, an information resource storage function, and an accesscontrol function with respect to the stored information resources. Insome implementations, functionality provided by wireless router 110 maybe supported, at least in part, by associated (e.g., paired)instructions (e.g., software and/or firmware) executed at a clientdevice and/or associated instructions (e.g., software and/or firmware)executed at a network server device. As one example, an operating systemor application program of client device 140 (e.g., represented asinstructions 146) may operate in combination with instructions 116 ofwireless router 110. For example, an application program operating atclient device 140 may initiate application programming interface (API)calls that may be received over LAN 190 by operating system 117 ofwireless router 110 via an API. As another example, software residing ata network server device (e.g., server device 160) of WAN 180 may operatein combination with instructions 116 of wireless router 110.

Storage system 114 of wireless router 110 may include a data store 128.Information may be stored at and/or retrieved from data store 128 byprocessor system 112. Such information may include information resources(e.g., electronic files, programs, session states, etc.), deviceprofiles, and user profiles, among other suitable information. Anon-limiting example of data store 128 is described in greater detailwith reference to FIG. 3. In contrast to traditional data caches,storage system 114 of wireless router 110 may additionally oralternatively contain short term information such as session data,and/or permanent or long term information such as profile informationand information resources including objects such as data dictionaries,or renderable content such as chunks of movie data or other mediacontent. Accordingly, wireless router 110 may include volatile storagesuch as RAM, non-volatile storage such as FLASH memory, a hard drive,etc.

Client devices 140 and 150 may take the form of a personal computer,mobile computing device, mobile communications device (e.g., Internetenabled phone), television set-top box, or other suitable electronicdevice. As one example, a client device, such as client device 140, mayinclude a processor system 142 to execute instructions 146 held instorage system 144. Instructions 146 may include or take the form ofsoftware and/or firmware. For example, instructions 146 may form part ofan operating system of client device 140, an application program, asoftware component such as a plug-in, or other suitable instruction set,or combination thereof. Instructions 146 may be executed by processorsystem 142 to present one or more of the interfaces described herein,for example, at a display device via input/output interfaces 149.Input/output interfaces 149 may receive user inputs directed at akeyboard, a touch-sensitive display device, a pointer device (e.g., acomputer mouse), or other suitable input device. In at least someimplementations, instructions 146 of client device 140 may be configuredto operate in coordination with or may be paired with instructions 116of wireless router 110. Storage system 144 may include a data store 148.Information may be stored at and/or retrieved from data store 148 byprocessor system 142. Some client devices, such as client device 140,may be further configured for WAN access without traversing wirelessrouter 110. As one example, client device 140 may further supportwireless connectivity via a mobile broadband technology such as, forexample, 3G or 4G.

FIG. 2 is a flow diagram depicting an example networking method 200. Asa non-limiting example, method 200 may be performed, at least in part,by previously described wireless router 110 of FIG. 1. During aregistration phase, the wireless router may establish a connection witha client device over the wireless local area network at 210. Thewireless router may detect a device identifier (e.g., a MAC address orother suitable identifier) of the client device at 212. If the deviceidentifier is one of first impression to the wireless router, the methodat 214 may include registering the device identifier at the wirelessrouter, for example, by associating the device identifier with a deviceprofile created at 216. The device identifier registered by the wirelessrouter may be referred to as the registered device identifier for theclient device. At 218, access privileges for the client device may beset by the wireless router at the device profile. An example deviceprofile and access privileges are described in greater detail withreference to FIGS. 3 and 4.

At 220, the wireless router may transmit a user registration interfaceto the client device over the wireless local area network forregistering the user. The user registration interface may be presentedby the client device, such as via a display device. In at least someimplementations, the user registration interface may be transmitted tothe client device and/or presented at the client device in response toone of the wireless router and the client device discovering the other.In at least some implementations, the wireless router may not transmitthe registration interface to the client device, but instead, a programresiding at the client device may present the registration interface inresponse to detecting the wireless router over the wireless local areanetwork. For example, the program residing at the client device may bepaired with or operate in cooperation with the wireless router.

At 222, the method may include receiving a user credential at thewireless router from the client device over the wireless local areanetwork. The user credential may be obtained as one or more user inputsdirected at the user registration interface presented by the clientdevice. As one example, the user credential may take the form of a username and/or password, or may be at least based, in part, on a user nameand/or password (e.g., a hashed value).

At 224, the user may be registered by storing the user credential at thewireless router associated with a user profile created at 226. The usercredential registered by the wireless router may be referred to as theregistered user credential for the user. At 228, access privileges forthe user may be set by the wireless router at the user profile. Anexample user profile and access privileges are described in greaterdetail with reference to FIGS. 3 and 4.

During a usage phase following the registration phase, the client devicemay request to initiate a communication session. In at least someimplementations, a device identifier may form part of the request. Thedevice identifier may be based, at least in part, on a hardwarecomponent and/or a software component of the client device. As oneexample, the device identifier may include a MAC address. The wirelessrouter receives the request to initiate a communication session over thewireless local area network from the client device. At 232, the wirelessrouter may authenticate the client device based, at least in part, onthe device identifier. For example, the wireless router may authenticatethe client device by comparing the device identifier to the registereddevice identifier, and if valid grant access to the client device inaccordance with the access privileges for the authenticated clientdevice. The wireless router may determine device settings for theauthenticated client device based on the device profile stored at thewireless router for the device identifier. The device settings mayinclude or otherwise indicate the access privileges for the clientdevice.

At 234, the wireless router may receive a user credential from theclient device over a wireless local area network. The user credentialmay be transmitted over the wireless local area network by the clientdevice responsive to a challenge issued by the wireless router or by aprogram executed at the client device. As one example, the challenge maybe issued by the wireless router that directs a program executed at theclient device to present the login interface by which the usercredential is obtained from the user. In at least some implementations,authentication of the user may be performed responsive to the request toinitiate the communication session if a threshold period of time hasbeen exceeded since a previous authentication of the user by thewireless router. The wireless router may withhold a challenge to theuser if the threshold period of time has not been exceeded. The user maybe authenticated during this threshold time period based on one or moreof the device identifier and/or an authentication state cookiepreviously transmitted to the client device and returned by the clientdevice with the request. As one example, the wireless router maymaintain a state table, with timers for each client device identifier.As another example, the wireless router may write, store, and transmitto a client device, an authentication state cookie with an encryptedvalue that identifies authentication state, authentication time, etc.Authentication state cookies may be used, for example, in the context ofclient devices that employ web browsers to initiate communications withthe wireless router and/or WAN.

The user credential may be obtained as one or more user inputs directedat a login interface presented by the client device, for example. At236, the wireless router may authenticate the user of the client devicebased, at least in part, on the user credential. The wireless router maydetermine user settings based, at least in part, on the user profilestored at the wireless router for the authenticated user of the clientdevice. The user settings may include the access privileges for theauthenticated user.

At 238, the wireless router may establish the communication session withthe authenticated client device, for example, by sending a response tothe authenticated client device over the wireless local area network. Aspart of the response or set of responses by the wireless router, thewireless router may transmit an indication to the authenticated clientdevice of the information resources accessible to the authenticatedclient device for presentation via a profile interface. The profileinterface will be described in greater detail with reference to FIG. 4.

At 240, the client device may request access to an information resourcestored at the wireless local area network. The wireless router receivesthe access request from the client device over the wireless local areanetwork. The wireless router may authenticate a user by comparing theregistered user credential to the user credential received from theclient device to determine if the user credential is valid.

At 242, the wireless router controls access to the requested informationresources stored at the wireless router (or accessible to the wirelessrouter from a remote networking device) during the communication sessionbased, at least in part, on one or more of the device settings (e.g.,access privileges) for the authenticated client device and/or the usersettings (e.g., access privileges) for the authenticated user. Forexample, at 244, the wireless router may control access to theinformation resources by granting the authenticated client device accessto a first subset of the information resources stored at the wirelessrouter associated with the device profile as indicated by the devicesettings, and by denying the authenticated client device access to asecond subset of the information resources stored at the wireless routernot associated with the device profile as indicated by the devicesettings.

As indicated at 246, access that is granted to the information resource(e.g., such as an electronic file, session state, or program) may bestored locally at the wireless router or may be served by a local serverdevice via the wireless router. An information resource may also beserved by a remote server device over the wide area network. If theinformation resource resides at a server device that is remote fromwireless router, then the wireless router may transmit a request for theinformation resource over a communications network (e.g., a WAN, LAN,etc.) and receive the information resource as a response. The wirelessrouter transmits the information resource or associated informationrequested by the client device to the client device over the wirelesslocal area network to fulfill the access request.

Access to the information resources stored at the wireless router duringa communication session may be based, at least in part, on both the usersettings for the authenticated user and the device settings for theauthenticated client device, or may be based on only one of the usersettings or the device settings depending on the access privilegesassociated with the particular information resource. The wireless routermay, for example, control access to the information resources bygranting the authenticated client device access to a first subset of theinformation resources associated with both the device profile asindicated by the device settings and the user profile as indicated bythe user settings, and may deny the authenticated client device accessto a second subset of the information resources not associated with boththe device profile and the user profile.

As previously discussed, information resources may include one or moreof an electronic file and/or a session state of a prior communicationsession or program session stored at the wireless router. Access to theelectronic file or the session state stored at the wireless router maybe controlled by enabling retrieval of the electronic file orcontinuation of the prior communication session or program session basedon the session state by the authenticated client device, or by enablingsharing of the electronic file or the session state by the authenticatedclient device with another client device indicated by the accessprivileges. Access control with respect to electronic files may includeany suitable type of access control, including write privileges, readprivileges, copy privileges, share privileges, etc. The informationresources may include a program executed at the wireless router aspreviously discussed. Access to the program executed at or executable bythe wireless router may be controlled, for example, by initiatingexecution of the program by the authenticated user, enabling programcontrol commands to be passed from the authenticated client device tothe program, and/or enabling responses generated by the program to bepassed to the authenticated client device.

The wireless router may be configured to store a plurality of deviceprofiles and a plurality of user profiles. If a user utilizes adifferent client device than used in a prior session to login to thewireless router, the wireless router may receive and store a deviceidentifier of the different client device at the wireless routerassociated with a different device profile. The device identifier of thedifferent client device may also be associated with the user profile inan account identity as will be described in greater detail withreference to FIG. 3. Accordingly, the wireless router may maintain arecord of the various devices operated by each user. Additionally oralternatively, the wireless router may maintain a record of the varioususers logging in via each client device.

FIG. 3 is a schematic diagram depicting an example account identity 300.Account identity 300 or portions thereof may be stored at a storagesystem of a wireless router (e.g., data store 128 of wireless router110) or other suitable networking device that is accessible to thewireless router. Account identity 300 may include one or more of a userprofile 310 and/or a device profile 320. Account identity 300 mayinclude or otherwise indicate one or more information resources 330associated with user profile 310 and/or device profile 320.

User profile 310 may include or be associated with one or more ofregistered user credentials 312, access privileges 314, and/or user data316. As previously described with reference to FIG. 2, user credentialsmay be used by a wireless router to authenticate a user. Usercredentials 312 may take the form of a user name and/or password, orother suitable information that may be used to authenticate a user. Usercredentials 312 may be provided by a user as part of a registrationprocess after which the registered user credentials may be compared touser credentials provided by a user in response to a subsequentchallenge to determine whether access is to be granted or denied. Userdata 316 may include or indicate other suitable information to beassociated with a user profile including, for example, the user's emailaddress, physical mailing address, telephone number, financial billinginformation, user preference settings, etc.

Device profile 320 may include or be associated with one or more of adevice identifier 322, access privileges 324, and/or device data 326.Device identifier 322 may indicate or may be based on a hardwarecomponent and/or a software component of a client device. For example,device identifier 322 may include a MAC address of the client device.Device data 326 may include or indicate any other suitable informationto be associated with a device profile including, for example, devicecapabilities, software version, device configurations, etc. Informationresources 330 associated with account identity 300 may include one ormore electronic files 332, session states 334, and/or programs 336.

The wireless router may create, store, and reference any suitable numberof account identities for one or more users and/or one or more clientdevices. For example, method 200 of FIG. 2 may be implemented by awireless router based on information indicated by or associated with oneor more account identities. Access privileges 314 of user profile 310and/or access privileges 324 of device profile 320 (collectivelyreferred to as access privileges of an account identity) may define oneor more user profiles and/or one or more device profiles that are to begranted access to information resources 330 or a subset of informationresources 330. In order from less limited access control to more limitedaccess control, these access privileges may indicate, with respect to anindividual information resource, that access is to be granted only to:(1) any user via any client device; (2) any user via one or morespecified client devices associated with device profile 320 and/or otherdevice profiles; (3) one or more specified users associated with userprofile 310 and/or other user profiles via any client device; (4) aparticular user associated with user profile 310 via any client device;(5) a particular user associated with user profile 310 via one or morespecified client devices associated with device profile 320 and/or otherdevice profiles; (6) any user via a particular client device associatedwith device profile 320; or (7) a particular user associated with userprofile 310 via a particular client device associated with deviceprofile 320.

As a non-limiting example, a user 342 may operate a client device 352 toprovide user inputs via a registration interface 362 for userregistration to establish a user profile at the wireless router, and toprovide user inputs via a login interface 364 for user authentication.Device registration may also be performed for client device 352 toestablish a device profile at the wireless router, and forauthentication of client device 352. User 342 may provide user inputsvia a profile interface 346 to select, browse, or otherwise interactwith information resources 330 and associated access privileges. Forexample, profile interface 336 lists information resources “A, B, C”accessible to user 342 via client device 352. Profile interface 336 mayalso provide one or more user controls “D, E, F” to adjust accessprivileges or otherwise interact with the wireless router. As oneexample, to share an information resource with another user, user 342may grant permission to user 344 that accesses the wireless router via adifferent client device 354 or via the same client device 352. User 342may direct user inputs to the user controls of the profile interface tocause the wireless router to add user 344 to (or alternatively removeuser 344 from) the access privileges associated with the sharedinformation resource on either a user level, a device level, or acombination of a user level and device level.

FIG. 4 is a schematic diagram depicting an example sequence of graphicaluser interfaces (GUIs) forming a profile interface. The GUIs of FIG. 4are non-limiting examples of profile interface 366 of FIG. 3. At leastsome of the information presented via these GUIs may be served orotherwise transmitted to client devices of a wireless local area networkby the wireless router. These GUIs may be used to access informationresources, manage access privileges among client devices and/or users,and initiate session hand-off and/or sharing of information resourcesbetween two or more client devices or between two or more differentusers of a common client device.

In FIG. 4, GUI 410 includes a sessions list from the perspective of auser profile for user “Sally”. The sessions list includes a number ofselectable session states, including Sally's network sessions that maybe re-established with a server device of the WAN, Sally's programsessions that may be re-established with a program executed at orexecutable by the wireless router, and other user's sessions that areaccessible to Sally based on access privileges set by those other users.The selectable session states may take the form of a graphical elementor hyperlink (e.g., URL) to which a user input may be directed in orderto re-establish a select session. User Sally may establish a newcommunications session, for example, by selecting a “New Session”control element.

GUI 412 includes a permissions list from the perspective of the userprofile for Sally. The permissions list enables Sally to define accessprivileges to information resources, including session states, programs,and/or files. GUI 412 includes example access privileges set for otherusers Mark and John, and for a client device identified as Device A.Mark, for example, has been granted access to Sally's “Session A”,“Program B”, and “File C”. Any user of Device A has been granted accessto “File C”. A user may navigate to the permissions list of GUI 412 fromGUI 410 by directing a user input at a “PERMISSIONS” control element.

GUI 414 includes a files list from the perspective of the user profilefor Sally. The files list includes Sally's electronic files stored atthe wireless router, and electronic files of other users that areaccessible to Sally. For example, Mark may have granted Sally (or aclient device operated by Sally) access privileges to one or moreelectronic files. A user may navigate to the files list of GUI 414 fromGUI 410 by directing a user input at a “FILES” control element. Theseelectronic files may include, for example, image files (e.g., .jpg),word processing files (e.g., .doc, .xls, etc.), instructions set files(e.g., .js), among other suitable file types. GUI 414 may include an“UPLOAD” control element to initiate an upload of an electronic filefrom the client device to the wireless router over the wireless localarea network. The uploaded file may be associated with the user profileand/or device profile of the source client device by the wirelessrouter. GUI 414 may include other control elements, such as “SHARE” toinitiate sharing of electronic files with other users and/or clientdevices via the wireless router, “SEND” to initiate transmission ofelectronic files to other user profiles and/or client devices from orvia the wireless router, and “SYNC” to synchronize electronic filesacross two or more client devices and/or user profiles. These controlelements may be included with other GUIs, including GUI 410 for sessionstates and GUI 416 for programs residing at the wireless router, and maybe used to initiate sharing, transmission, or synchronization of theseinformation resources between or among client devices and/or userprofiles via the wireless router.

GUI 416 includes a programs list from the perspective of the userprofile for Sally. The programs list includes Sally's programs residingat the wireless router, and programs of other users residing at thewireless router that are accessible to Sally. For example, Mark may havegranted Sally (or a client device operated by Sally) access privilegesto one or more programs. A user may navigate to the programs list of GUI416 from GUI 410 by directing a user input at a “PROGRAMS” controlelement.

The GUIs of FIG. 4 may be accessed by users via a general purpose orspecial purpose application program executed at their respective clientdevices. A special purpose program may be dedicated to controlling andmanaging the wireless router. A general purpose or multi-purposeapplication program may take the form of a web browser or file browser,for example. As one example, these GUIs may be presented in a webpageviewing region of a browser, or in a menu system of the browser. Asanother example, the GUIs of FIG. 4 may be presented in a menu system ortask bar of an operating system of a client device.

The example GUIs of FIG. 4 may be accessed by users in a number of ways,such as the through one or more of the previously described APIs. As oneexample, a user may navigate a client device to a well-known URI, orcapture DNS. As another example, a user may enter a URL or URI (e.g.,such as a malformed, but easy to remember URI) in a browser address bar(e.g., such as “ROUTER” or “SHARE”). The wireless router may beconfigured to intercept the DNS query and interpret the query as a SHAREcommand. In response to the SHARE command, the wireless router may beconfigured to serve a profile interface (e.g., one or more of the GUIsof FIG. 4) back to the client device that enables the user to shareinformation with another user and/or client device of the LAN.

In at least some implementations, the wireless router may be configuredto listen for commands, and serve GUIs in response to requests (e.g.,the SHARE command) from a client device. For example, the wirelessrouter may provide a number of functions, such as “SHARE”, “SETTINGS”,“PICKUP SESSION”, etc. Each function may cause the wireless router toreturn a different functional interface to a client device to bedisplayed to a user.

In at least some implementations, the wireless router may be configuredto transmit data to a client device representing one or more of theregistration interface, login interface, profile interface, etc.responsive to receiving a request at a secret address (e.g., URL or URI)of the wireless router that was initiated by the client device. Forexample, a secret URL may take the form of or may be based on a sharedsecret between the wireless router and a client device. A secret addressmay be programmatically generated by the wireless router or by anapplication operating on the client device, and/or the secret addressmay be at least partially user defined. A secret address may be changedover time (e.g., periodically or responsive to a condition) to increasesecurity. The wireless router may support one or more secret addressesper device profile and/or one or more secret addresses per user profile.Two or more secret addresses for a given client device may be used todistinguish between two or more different types of functional interfacesthat provide access to router different functionality.

The access control techniques and functional interfaces described hereinmay be used to enable a user to define and adjust quality of serviceparameters applied at the wireless router for a user profile(representing a user) and/or device profile (representing a clientdevice). As one example, a user profile and/or a device profile may beassigned a maximum bandwidth threshold (e.g., maximum data rate) and/ora minimum bandwidth threshold (e.g., minimum data rate) for accessingresources of the WAN via the wireless router over the LAN. Quality ofservice parameters may be defined and controlled on a per user profilebasis and/or a per device profile basis. Accordingly, users and/orclient devices may communicate with the wireless router and/or WANresources via the wireless router at different data rates based, atleast in part, on the quality of service parameters assigned to thoseusers and/or client devices. In at least some implementations, a userprofile may take the form of an administrative user profile that has theability to define and adjust quality of service parameters that areapplied to other user profiles and/or device profiles by the wirelessrouter. The wireless router may be configured to apply quality ofservice parameters by throttling bandwidth of at least some users and/orclient devices so that communications do not exceed a maximum bandwidththreshold and/or so that a minimum bandwidth threshold is guaranteed forother users and/or client devices.

The access control techniques and functional interfaces described hereinmay be used with features described in greater detail in U.S. patentapplication Ser. No. 13/309,505, titled GATEWAY ROUTER SUPPORTINGSESSION HAND-OFF AND CONTENT SHARING AMONG CLIENTS OF A LOCAL AREANETWORK, filed Dec. 1, 2011, and U.S. patent application Ser. No.13/367,556, titled APPLICATION PROGRAMMING INTERFACE FOR ENHANCEDWIRELESS LOCAL AREA NETWORK ROUTER, filed Feb. 7, 2012, the entirecontents of which are incorporated herein by reference in their entiretyfor all purposes.

A smart router may be configured to store the historical router-devicecommunications data, such as depicted in FIG. 5, in a database in therouter mass storage, or in a location accessible by the router via theLAN or WAN, such as at the smart router service depicted in FIG. 6. Therouter-device connection statistics are continually updated based oneach new communication session between a particular device and therouter. Since this data typically is stored at the router, the clientdevice typically does not have access to it. Rather, the smart routerstores the router-device pair connection history data, and based on thatdata can adjust its own communications protocol parameters accordingly.Many of the settings that would be adjusted (retransmit, MSS, andcongestion control window) are TCP settings and could beprogrammatically set in TCP, or TCP+.

As shown in FIG. 6, the smart router itself may include a WAN sidenetwork protocol stack and a LAN side network protocol stack, each ofwhich may include optimized protocol modules configured to enableoptimized communications between client devices on the LAN and remoteservers over the WAN, via the smart router. FIG. 6 illustrates that aclient session agent is assigned to each client session between clientdevices and the smart router, and a server session agent is assigned toeach server session between the smart router and a remote server overthe WAN. The client session agent instantiates an instance of the LANside protocol stack. The LAN side protocol stack in turn modifiesvarious aspects of the LAN side traffic between the client device andsmart router to achieve the various functionalities described herein,before passing the traffic stream on to an instance of the WAN sideprotocol stack, which has been instantiated by a corresponding serversession agent. The server session agent and WAN side protocol stack aretasked with managing connections between a corresponding server on theWAN, and the smart router. In the illustrated example, the transportlayer of the client side network protocol stack instance performsTCP+/UDP protocol translation, explained in more detail below, and alsoreceives performance data such as signal strength information for theantenna on the smart router, and adjusts the TCP settings based on thesignal strength, as discussed in detail below. The application layer ofthe client side protocol stack instance performs translation from SPDYon the WAN side to SPDY+ (explained below), as one example, so thatcommunications between the smart router and the client at theapplication layer are performed according to the SPDY+ protocol. Otherapplication layer protocol translation schemes may also be implemented.

In some cases, the server may be a server system, such as a data center,which includes a network appliance, such as a server load balancer orapplication delivery controller, positioned logically in front one ormore back end servers. Thus, it will be appreciated that the serversthemselves, or the network appliances, may be configured to communicatein specialized protocols, such as described below, and the server sidesession agent and WAN side network protocol stack instance may be ableto process responses from the server and forward them back to therequesting client device via the LAN side network protocol stack. Toenable the smart router to understand which protocols the server ornetwork appliance communicate with, the smart router may download aserver profile, which contains data indicating any applicable serverspecific protocols.

The smart router may be in communication with a smart router serviceexecuted on a server connected to a smart router client executed on thesmart router, via the WAN. The smart router client may upload userprofile data so that users of the smart router may access and their userprofile data from a cloud based management portal. In this manner, anadmin of the smart router may easily edit user privileges, assign usersto groups, etc. Further, the router settings themselves may be uploadedfor cloud-based access, and thus a copy of the smart router settings maybe uploaded to the smart router service and made accessible to anauthorized user via a computing device over the WAN, for example.Finally, various protocol updates may be downloaded from the smartrouter service to the smart router client, to implement securityupdates, performance improvements, etc.

It should be understood that the embodiments herein are illustrative andnot restrictive, since the scope of the invention is defined by theappended claims rather than by the description preceding them. Allchanges that fall within metes and bounds of the claims or equivalenceof such metes and bounds thereof are therefore intended to be embracedby the claims.

The invention claimed is:
 1. A wireless networking method, comprising:receiving a request from a client device at a wireless router toinitiate a communication session over a wireless local area network ofthe wireless router; establishing the communication session between thewireless router and the client device over the wireless local areanetwork; storing session information from the communication session in alocal data store of the wireless router; updating historicalrouter-device communications data including router-device connectionstatistics based on the session information; transmitting the historicalrouter-device communications data including the router-device connectionstatistics to a remote server for storage via a wide area network;wherein the request to initiate the communication session includes or isfollowed by another request initiated by the client device for aninformation resource stored at the wireless router; and controllingaccess by the client device to the information resource stored at thewireless router during the communication session based, at least inpart, on access privileges for the client device stored in a profile atthe wireless router.
 2. The method of claim 1, further comprising: priorto establishing the communication session, authenticating the clientdevice based on a client identifier received from the client device. 3.The method of claim 2, wherein authenticating the client device isfurther based on a user credential received from the client device. 4.The method of claim 1, wherein the request to initiate the communicationsession includes or is followed by a third request initiated by theclient device for an additional information resource of a server deviceof the wide area network accessible to the client device via thewireless router.
 5. The method of claim 4, further comprising:responsive to receiving the third request for the information resourcefrom the client device: transmitting a request for the additionalinformation resource to the server device over the wide area network,receiving the additional information resource from the server deviceover the wide area network, and transmitting the additional informationresource to the client device over the wireless local area network. 6.The method of claim 1, wherein the information resource includes anelectronic file or a session state of a previous communication sessionwith the wireless router.
 7. The method of claim 1, further comprising:receiving a device identifier from the client device; and storing thedevice identifier of the client device at the wireless router in theprofile.
 8. A wireless router serving as a wireless local area networkaccess point for one or more client devices to access a wide areanetwork, the wireless router comprising: a processor system; a storagesystem holding instructions executable by the processor system to:receive a first request from a client device at the wireless router toinitiate a communication session over the wireless local area network ofthe wireless router; establish the communication session between thewireless router and the client device over the wireless local areanetwork; store session information from the communication session in alocal data store of the wireless router; update historical router-devicecommunications data including router-device connection statistics basedon the session information; transmit the historical router-devicecommunications data including the router-device connection statistics toa remote server for storage via the wide area network wherein the firstrequest to initiate the communication session includes or is followed bya second request initiated by the client device for an informationresource stored at the wireless router; and responsive to the secondrequest, control access by the client device to the information resourcestored at the wireless router during the communication session based, atleast in part, on access privileges for the client device stored in aprofile at the wireless router.
 9. The wireless router of claim 8,wherein the instructions are further executable by the processor systemto: prior to establishing the communication session, authenticate theclient device based on a client identifier received from the clientdevice.
 10. The wireless router of claim 9, wherein the client device isauthenticated based on a user credential received at the wireless routerfrom the client device.
 11. The wireless router of claim 8, wherein thefirst request to initiate the communication session includes or isfollowed by a third request initiated by the client device for anadditional information resource of a server device of the wide areanetwork accessible to the client device via the wireless router.
 12. Thewireless router of claim 11, wherein the instructions are furtherexecutable by the processor system to: responsive to receiving the thirdrequest for the additional information resource from the client device:transmit a request for the additional information resource to the serverdevice over the wide area network, receive the additional informationresource from the server device over the wide area network, and transmitthe additional information resource to the client device over thewireless local area network.
 13. The wireless router of claim 8, whereinthe information resource includes an electronic file or a session stateof a previous communication session with the wireless router. 14.Wireless router of claim 8, wherein the instructions are furtherexecutable by the processor system to: receive a device identifier fromthe client device; and store the device identifier of the client deviceat the wireless router in the profile.